Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can setup a malicious SSH server with HostCertificate,
and invite an OpenSSH client to connect, without checking SSHFP.

Impacted products: Debian, MBS, OpenSSH, Ubuntu

Severity: 2/4

Creation date: 26/03/2014

DESCRIPTION OF THE VULNERABILITY

The SSHFP (RFC 4255) feature is used to publish SSH keys
fingerprints in DNS records.

However, when a SSH server presents a HostCertificate, and when
the OpenSSH client refuses it, it does not check SSHFP. The user
is still presented the host verification prompt.

An attacker can therefore setup a malicious SSH server with
HostCertificate, and invite an OpenSSH client to connect, without
checking SSHFP.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/OpenSSH-bypassing-SSHFP-via-HostCertificate-14480